@agfpd/iapeer 0.2.32 → 0.2.33

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agfpd/iapeer",
-  "version": "0.2.32",
+  "version": "0.2.33",
   "description": "Foundation core for the iapeer multi-agent ecosystem: identity, registry, storage, codec.",
   "type": "module",
   "bin": {

package/src/launch/canary.ts

@@ -117,7 +117,7 @@ export function canaryScript(o: CanaryScriptOptions): string {
     `{`,
     `  echo "server-death identity=${o.identity} ts=$ts server_pid=$SPID wait_rc=$rc cause=$cause"`,
     `  echo '--- vm_stat'; vm_stat`,
-    `  echo '--- swapusage'; sysctl -n vm.swapusage`,
+    `  echo '--- swapusage'; /usr/sbin/sysctl -n vm.swapusage`,
     `  echo '--- ps-top-rss'; ps axo pid,ppid,rss,etime,command | sort -rn -k3 | head -25`,
     `  echo '--- diagnosticreports-user'; ls -t "$HOME/Library/Logs/DiagnosticReports" 2>/dev/null | head`,
     `  echo '--- diagnosticreports-system'; ls -t /Library/Logs/DiagnosticReports 2>/dev/null | head`,

package/src/lifecycle/index.ts

@@ -654,7 +654,7 @@ export function classifyGoneSession(sock: string): { death: 'server-dead' | 'ses
   // proves the server is alive and merely lost this session.
   return tmux(sock, 'list-sessions').ok
     ? { death: 'session-gone', reason: 'session gone, tmux server alive (exit cause should be in exits.log)' }
-    : { death: 'server-dead', reason: 'tmux server dead — stale socket (SIGKILL/OOM class; check exits.log ev=server-exit canary record)' }
+    : { death: 'server-dead', reason: 'tmux server dead — stale socket (SIGKILL class — OOM only if a matching JetsamEvent report exists; check exits.log ev=server-exit canary record)' }
 }
 
 // ─────────────────────────────────────────────────────────────────────────────
@@ -790,6 +790,13 @@ export interface WakeResult {
    *  deliberate halt, distinct from offline/wake-failure). The sender is told the
    *  peer is stopped, not that delivery failed transiently. */
   stopped?: boolean
+  /** Was `task` actually delivered by this wake? true on the launch path (the
+   *  task rode as the boot first-message); FALSE on the idempotent live-session
+   *  fast path — a CONCURRENT sender's boot won the lock and only ITS envelope
+   *  was delivered; this caller's task was NOT. The caller (routeSend) must then
+   *  deliver the envelope itself via the live path, or the second sender's
+   *  message is silently lost behind a false ok (contract forbids silent loss). */
+  taskDelivered?: boolean
 }
 
 export interface WakeDeps {
@@ -890,7 +897,9 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
     // wake already brought it up) — no second spawn.
     if (sessionAlive(sock, identity)) {
       writeSessionState(cfg, { identity, runtime, personality: args.personality, cwd, wokeAt: Date.now() })
-      return { status: 'READY', woke: false, runtime, process_address: identity }
+      // taskDelivered:false — the winning concurrent wake delivered ITS OWN task as
+      // the boot first-message; THIS caller's task was not delivered by anything.
+      return { status: 'READY', woke: false, runtime, process_address: identity, taskDelivered: false }
     }
     if (!existsSync(cwd)) {
       return { status: 'FAILED', woke: false, runtime, reason: `peer cwd does not exist: ${cwd}` }
@@ -997,7 +1006,7 @@ export async function wakeOrSpawn(args: WakeArgs, deps: WakeDeps = {}): Promise<
     // ring — a successful wake means this is NOT a tight crash loop. Best-effort.
     writeTopic(cfg, identity, args.topic?.trim() ?? '')
     trimDeaths(cfg, identity, cfg.crashLoopWindowSecs, Date.now())
-    return { status: 'READY', woke: true, runtime, process_address: identity }
+    return { status: 'READY', woke: true, runtime, process_address: identity, taskDelivered: true }
   })
 }
 

package/src/lifecycle/lifecycle.test.ts

@@ -284,6 +284,40 @@ describe('wakeOrSpawn H4 refusal', () => {
   })
 })
 
+// ─────────────────────────────────────────────────────────────────────────────
+// wakeOrSpawn live-session fast path — marks the caller's task as NOT delivered
+// (the concurrent-sender envelope-loss seam: routeSend redelivers on this flag)
+// ─────────────────────────────────────────────────────────────────────────────
+
+describe('wakeOrSpawn live-session fast path', () => {
+  test('READY with taskDelivered:false — the winning wake delivered only ITS envelope', async () => {
+    const root = mkdtempSync(join(tmpdir(), 'iapeer-fpl-root-'))
+    const laDir = mkdtempSync(join(tmpdir(), 'iapeer-fpl-la-')) // empty → not launchd-managed
+    const sockDir = join(root, 'socks')
+    const sock = join(sockDir, 'tmux-iap-claude-fpl.sock')
+    try {
+      mkdirSync(sockDir, { recursive: true })
+      await upsertPeer(
+        { personality: 'fpl', runtime: 'claude', cwd: root, intelligence: 'artificial' },
+        { rootDir: root },
+      )
+      // a live session already up — what a WINNING concurrent wake leaves behind
+      const up = spawnSync('tmux', ['-S', sock, 'new-session', '-d', '-s', 'claude-fpl', 'cat'], { encoding: 'utf8' })
+      expect(up.status).toBe(0)
+      const env = { ...process.env, IAPEER_ROOT: root, IAPEER_LAUNCHAGENTS_DIR: laDir }
+      const r = await wakeOrSpawn({ personality: 'fpl', runtime: 'claude', task: 'second sender envelope' }, { env })
+      expect(r.status).toBe('READY')
+      expect(r.woke).toBe(false)
+      // the contract under test: the fast path NEVER delivers the caller's task
+      expect(r.taskDelivered).toBe(false)
+    } finally {
+      spawnSync('tmux', ['-S', sock, 'kill-server'], { encoding: 'utf8' })
+      rmSync(root, { recursive: true, force: true })
+      rmSync(laDir, { recursive: true, force: true })
+    }
+  })
+})
+
 // ─────────────────────────────────────────────────────────────────────────────
 // C1 — durable stopped flag (stop/start; daemon refuses to wake a stopped peer)
 // ─────────────────────────────────────────────────────────────────────────────

package/src/transport/index.ts

@@ -408,6 +408,12 @@ export interface WakeOutcome {
    *  refused, not failed. routeSend surfaces an explicit "stopped" error to the
    *  sender (contract Демон §stopped: stopped → no wake, no queue, clear error). */
   stopped?: boolean
+  /** Did the wake itself deliver `task` (as the boot first-message)? An impl
+   *  returns FALSE from its idempotent live-session fast path (a concurrent wake
+   *  won and delivered only ITS envelope) — routeSend then delivers this caller's
+   *  envelope via the live path. undefined → assumed delivered (legacy impls keep
+   *  their prior behavior; the in-repo wakeOrSpawn always sets it explicitly). */
+  taskDelivered?: boolean
 }
 export type WakeFn = (req: WakeRequest) => Promise<WakeOutcome>
 
@@ -551,6 +557,23 @@ export async function routeSend(
     return err(`woke "${personality}" but the session is not live (verify-before-act): ${live.error.message}`)
   }
   if (live.value.address === caller.address) return err('cannot send to self')
+  // taskDelivered:false — the wake took the idempotent live-session fast path (a
+  // CONCURRENT sender's boot won the wake.lock and delivered only ITS envelope as
+  // the boot first-message). OUR envelope was not delivered by anything yet —
+  // deliver it NOW via the live path (submit-confirm + liveness guards apply).
+  // Without this, the second concurrent sender's message is silently lost behind
+  // a false ok:true — the class the contract forbids. A delivery failure here is
+  // surfaced loudly (false-FAIL over false-OK).
+  if (woke.taskDelivered === false) {
+    const delivered = deliverViaTmux(live.value, envelope, peer.cwd)
+    if (!delivered.ok) return delivered
+    return ok({
+      ok: true,
+      delivered_to: { personality: live.value.personality, runtime: live.value.runtime },
+      woke: false, // honest: this sender's envelope went the LIVE path, not a boot
+      ts: new Date().toISOString(),
+    })
+  }
   // The envelope was delivered as the boot first-message during wake.
   return ok({
     ok: true,

package/src/transport/routesend-wake.test.ts

@@ -0,0 +1,139 @@
+// routeSend wake-path delivery guarantee — the concurrent-sender fast-path hole.
+//
+// The race (found by code-read 09.06, vault «Находка — wake-on-miss fast-path …»):
+// sender A's wake boots the session (A's envelope = boot first-message); sender B,
+// blocked on wake.lock, enters AFTER the boot and takes the idempotent live-session
+// fast path — which delivers NOTHING. Pre-fix, routeSend then reported {ok:true,
+// woke:true} for B while B's envelope was silently lost (the class the delivery
+// contract forbids). Post-fix, wakeOrSpawn marks the fast path taskDelivered:false
+// and routeSend delivers B's envelope itself via the LIVE path.
+//
+// The fake WakeFn here reproduces the loser-of-the-lock outcome exactly: it brings
+// the session up itself (= what the winning concurrent wake did) and returns READY
+// without having delivered the caller's task.
+
+import { afterAll, beforeAll, describe, expect, test } from 'bun:test'
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'fs'
+import { tmpdir } from 'os'
+import { join } from 'path'
+import { spawnSync } from 'child_process'
+import { routeSend, type WakeFn } from './index.ts'
+import type { ResolvedCaller } from '../identity/index.ts'
+import type { PeerRecord } from '../registry/index.ts'
+
+let root: string
+let sockDir: string
+const prevRoot = process.env.IAPEER_ROOT
+
+// Target peer: NON-TUI runtime (telegram) → the C-j delivery path lands into a
+// plain `cat` pane with no TUI prompt machinery; capture-pane then shows the
+// envelope text verbatim.
+// NB: keep names SHORT — the tmux socket lives under mkdtemp and the unix
+// socket path limit on macOS is 104 bytes.
+const TARGET = 'fpw'
+const SESSION = `telegram-${TARGET}`
+const sockPath = () => join(sockDir, `tmux-iap-telegram-${TARGET}.sock`)
+
+const callerRecord = {
+  personality: 'boris',
+  runtime: 'claude',
+  runtimes: ['claude'],
+  description: '',
+  intelligence: 'artificial',
+  cwd: '/tmp/boris',
+} as unknown as PeerRecord
+const caller: ResolvedCaller = {
+  personality: 'boris',
+  runtime: 'claude',
+  address: 'claude-boris',
+  description: '',
+  intelligence: 'artificial',
+  cwd: '/tmp/boris',
+  record: callerRecord,
+}
+
+function startTargetSession(): void {
+  const r = spawnSync('tmux', ['-S', sockPath(), 'new-session', '-d', '-x', '200', '-y', '50', '-s', SESSION, 'cat'], {
+    encoding: 'utf8',
+  })
+  if (r.status !== 0) throw new Error(`tmux new-session failed: ${r.stderr}`)
+}
+
+function killTargetSession(): void {
+  spawnSync('tmux', ['-S', sockPath(), 'kill-server'], { encoding: 'utf8' })
+}
+
+function capturePane(): string {
+  const r = spawnSync('tmux', ['-S', sockPath(), 'capture-pane', '-p', '-t', SESSION], { encoding: 'utf8' })
+  return r.stdout ?? ''
+}
+
+beforeAll(() => {
+  root = mkdtempSync(join(tmpdir(), 'fpw-'))
+  sockDir = join(root, 'socks')
+  mkdirSync(sockDir, { recursive: true })
+  writeFileSync(
+    join(root, 'peers-profiles.json'),
+    JSON.stringify({
+      version: 2,
+      peers: [
+        { personality: 'boris', runtime: 'claude', runtimes: ['claude'], description: '', intelligence: 'artificial', cwd: '/tmp/boris' },
+        { personality: TARGET, runtime: 'telegram', runtimes: ['telegram'], description: '', intelligence: 'artificial', cwd: root },
+      ],
+    }),
+  )
+  process.env.IAPEER_ROOT = root
+})
+afterAll(() => {
+  killTargetSession()
+  if (prevRoot === undefined) delete process.env.IAPEER_ROOT
+  else process.env.IAPEER_ROOT = prevRoot
+  rmSync(root, { recursive: true, force: true })
+})
+
+describe('routeSend wake fast-path (concurrent-sender envelope loss)', () => {
+  test('taskDelivered:false → routeSend delivers the envelope itself via the live path', async () => {
+    const marker = 'SECOND-SENDER-ENVELOPE-7741'
+    // The loser-of-the-lock outcome: the session is up (the WINNING wake booted it),
+    // READY came back, but THIS caller's task was never delivered.
+    const wake: WakeFn = async () => {
+      startTargetSession()
+      return { status: 'READY', woke: false, runtime: 'telegram', taskDelivered: false }
+    }
+    const r = await routeSend(caller, { personality: TARGET, message: marker }, { wake })
+    expect(r.ok).toBe(true)
+    if (!r.ok) return
+    // honest woke flag: the envelope went the LIVE path, not a boot first-message
+    expect(r.value.woke).toBe(false)
+    expect(r.value.delivered_to).toEqual({ personality: TARGET, runtime: 'telegram' })
+    // the envelope actually LANDED in the session (pre-fix: silently lost)
+    expect(capturePane()).toContain(marker)
+    killTargetSession()
+  })
+
+  test('legacy WakeFn without taskDelivered → prior behavior (no redelivery, woke:true)', async () => {
+    const marker = 'LEGACY-IMPL-ENVELOPE-9962'
+    const wake: WakeFn = async () => {
+      startTargetSession()
+      return { status: 'READY', woke: true, runtime: 'telegram' } // field absent → assumed delivered
+    }
+    const r = await routeSend(caller, { personality: TARGET, message: marker }, { wake })
+    expect(r.ok).toBe(true)
+    if (!r.ok) return
+    expect(r.value.woke).toBe(true)
+    // assumed delivered as the boot first-message → routeSend must NOT double-deliver
+    expect(capturePane()).not.toContain(marker)
+    killTargetSession()
+  })
+
+  test('taskDelivered:false but the session died right after wake → loud failure, not false ok', async () => {
+    const wake: WakeFn = async () => {
+      // READY without a live session: verify-before-act must catch it
+      return { status: 'READY', woke: false, runtime: 'telegram', taskDelivered: false }
+    }
+    const r = await routeSend(caller, { personality: TARGET, message: 'never lands' }, { wake })
+    expect(r.ok).toBe(false)
+    if (r.ok) return
+    expect(r.error.message).toMatch(/verify-before-act|not live/)
+  })
+})